It seems Perl (or the C runtime) emulates stat() on Windows. The emulation roughly looks like what a common Unix system returns when an ACL system runs on top of the standard Unix permissions. See also Re^3: Inline.pm and untainting.

sub is_safe_file {
   my $path = shift;
   stat($path) || return;    # mysteriously vaporized
   my ( $dev, $ino, $mode, $nlink, $uid, $gid ) = stat(_);

   return 0 if $uid != 0 && $uid != $<;
   return 0 if $mode & 022;
   return 1;
} ## end sub is_safe_file
[download]

This piece of code has no idea of that emulation. Unfortunately, it also has no idea of an ACL system on top of Unix permissions. That should not hurt on Unix, because even with an ACL system on top of the Unix permissions, criticial files should have restrictive Unix permissions. The stat() emulation on Windows has no Unix permissions.

So, is_safe_file() may need to disable the $mode check if $^O eq 'MSWin32'. Perhaps it should also add some Windows-specific ACL tests.

Alexander